[GUIDE] RSA-Removal Z3

[BF]

RSA-Removal for Z3

All Credit for this process, patches, and DualBoot go to GandjaFuzz and Vilko
Credit for Boot_0AC0_Patch and Boot_Start_SW goes to Osta
Huge THANKS to them for granting me permission to post this

The original guide can be found on MotoFan, in the Breaking and Build forum

************index.php?showtopic=115561

Spanish Thread

Thanks to 98xploder for assembling the RSA Removal Pack, and also for providing key info and testing
Thanks to thelaxplaya7 for picture of TestPoint location

* and # and Power will load the normal bootloader
* and Power will make it detected as S Blank Neptune LTE2, and is used for flashing RSA-Removed firmware

Supplies

• RSD Lite (Use Google)
• Flash&Backup3
• Stock 0DR MP
• Z3 RSA Removal Kit
  • TestPoint Image
  • RAMLDR2
  • Boot_0AC0_patch.bin
  • RSA-Removed 0DR
  • DualBoot 3.3 by GandjaFuzz & Vilko
  • Boot_Start_SW.bin
  • For Self-Creation of Firmware:
    • RunPhoneLTE2

The TestPoint

tp2pic.jpg
testpointz3.jpg

Get a BOOT and PDS Backup
It was explained to me to get these two backups with Flash&Backup3 but I was only able to get a PDS backup with GOTMOTO

• Edit the Flash&Backup3 profile R452B_Z3.prof located in the Profiles directory with NotePad. Remove the semicolon from in front of BOOT and PDS
• Perform a testpoint to achieve S Blank Neptune LTE2 (Confirm BLANK with RSD)
• Open Flash&Backup3, and using the edited profile, take a backup of your BOOT and PDS

Procedure

-Only ONE time does a TestPoint need to be performed, at Step 2
-The purpose of the Boot_0AC0_Patch.bin is to fool the phone into being BLANK for the rest of the process
-So do NOT do a TP to achieve BLANK for EACH step, let Boot_0AC0_Patch.bin do its job.
-In between each step after Boot_0AC0_Patch.bin has been written, all you need to do is slightly lift the battery, then let it make contact, and you will have the required BLANK for the next step
-The Boot_Start_SW.bin will make the RSA-Removed firmware work

1. RSD Lite; Flash the stock 0DR MP with RSD Lite
2. TestPoint; Perform a testpoint to achieve S Blank Neptune LTE2 (Confirm BLANK with RSD)
3. RAMLDR2; Send loader, Show OK
4. RAMLDR2; Write Boot - Boot_0AC0_Patch.bin, Show OK
5. Slightly Lift Battery
6. Flash&Backup3; Flash RSA-Removed 0DR
7. Slightly Lift Battery
8. Flash&Backup3; Flash prepared CG18 DualBoot Flash
9. Slightly Lift Battery
10. RAMLDR2; Send Loader, Show OK
11. RAMLDR2; Write Boot - Boot_Start_SW.bin, Show OK
12. Slightly Lift Battery
13. See What RSD Lite Detects
    

If RSDLite sees 'Motorola Phone (Z3)' then it was a success. If it doesn't, follow on to Troubleshooting

Troubleshooting

If RSDLite sees S Flash Neptune LTE2, it means you are stuck in BootLoader mode with PHONE CODE SIG ERROR 35:02 and the Boot_Start_SW.bin did not take, perform these steps:

• TestPoint
• RAMLDR2, Write Boot - Boot_0AC0_Patch.bin, Show OK
• Slightly Lift Battery
• RAMLDR2; Write Boot - Boot_Start_SW.bin, Show OK
• Slightly Lift Battery
• Recheck the status in RSD Lite

If you recieve 'USB Device Unrecognized':

• Perform the TestPoint and do all of the steps over again

[Russoeternal]

Simply awesome B & 98!!!!!

[doc0047]

Haha!:dance:Nice work!

[98xploder]

trust me guys, its worth it. if nobody tries it, then all my bricks in the past 72 hours were for nothing.
anyway, here is my video that shows the rsa removed with the dualboot and the hellomoto screen gone.

IMPORTANT NOTICE: No media files are hosted on these forums. By clicking the link below you agree to view content from an external website. We can not be held responsible for the suitability or legality of this material. If the video does not play, wait a minute or try again later.

I AGREE

[Haskano]

WoooW tanks...

[dwi.wicaksono]

Finally . Great work B & 98.
when this will work on L9/L72....

[craiglopez]

Haha!:dance:Nice work!

[narcio27]

hahaha nice job!

[904Boricua]

will this only work for 0A.C0?..or both bootloaders

[BF]

will this only work for 0A.C0?..or both bootloaders

It will work for any bootloader.
98xploder had 0A.C3 before, and I don't know what I had because I never looked, but I don't think it was 0A.C0

Finally . Great work B & 98.
when this will work on L9/L72....

I've spoken with GandjaFuzz about L9 and it was explained to me that everything will work except that Boot_Start_SW.bin will most likely not start the firmware because of a different IROM

[Chakal]

if i remove rsa and make a full backup and put my backup in other phone....
that phone stay with RSA removed too?

[pedrohp]

Great work, but i still don't get what new features this could bring to my Z3, or what new mod it would unlock

[the_tron]

Link for RSA Removal Pack is down

[98xploder]

if i remove rsa and make a full backup and put my backup in other phone....
that phone stay with RSA removed too?

no. gotta remove rsa with a tp. if you flash this fw or a backup of rsa removed fw without tp, it will brick it. it will not remove rsa

Great work, but i still don't get what new features this could bring to my Z3, or what new mod it would unlock

it enables the use of patches. b is working on itunes right now which will only be possible with rsa removed. you can patch the cg1 so there is no hellomoto bootscreen. you can patch so bluetooth find me time is 15 minutes. there are a number of mods you can do when rsa is removed. look how moddable the l7 is. thats only because of rsa removal.

Link for RSA Removal Pack is down

works for me

[BF]

ill get back on itunes today, after i do a few errands....
there are many more patches guys, ill make a writeup about them later